Shadow AI — employees using free personal accounts to process company data — is the highest-volume AI risk in most organizations. This checklist gives IT and security teams a structured discovery process to find it before it shows up in a compliance audit or a leak headline.

What's inside

Three-phase discovery: network-level traffic analysis, expense/SaaS audit, and employee survey. Each phase has explicit signals to look for and follow-up actions when you find them.

How to use it

  1. Walk through every item in order — skipping ahead usually means missing the prerequisite that makes a later item work.
  2. Score honestly. The point of a checklist is to surface gaps, not to feel good about what's already done.
  3. Run it again in 90 days. Checklists are a baseline; the value is in the delta between runs.